<html>
<head><meta charset="utf-8"><title>RFC: Send/Sync/UnsafeCell/Uniqueness · project-safe-transmute · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/index.html">project-safe-transmute</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html">RFC: Send/Sync/UnsafeCell/Uniqueness</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="204131471"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204131471" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204131471">(Jul 16 2020 at 19:29)</a>:</h4>
<p>So <span class="user-mention" data-user-id="224872">@Ryan Levick</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/transmute.20options/near/203724257">previously</a> wondered about transmutation's interactions with <code>Send</code> and <code>Sync</code>, which I suspect are closely related to the interactions with <code>UnsafeCell</code> and pointer uniqueness.</p>
<p>I don't have a complete sense of these interactions, and I'd like to.</p>



<a name="204131940"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204131940" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204131940">(Jul 16 2020 at 19:33)</a>:</h4>
<p>Within reference transmutations, <code>UnsafeCell</code> has clear soundness issues: </p>
<ul>
<li><code>&amp;mut bool ⇏ &amp;mut u8</code>: validity violated</li>
<li><code>&amp;AtomicBool ⇏ &amp;AtomicU8</code>: validity violated</li>
<li><code>&amp;AtomicU8 ⇏ &amp;u8</code>: potential for unsynchronized loads of <code>&amp;u8</code></li>
</ul>
<p>(the <code>Atomic*</code> types are just wrappers around <code>UnsafeCell</code>s)</p>



<a name="204138422"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204138422" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204138422">(Jul 16 2020 at 20:28)</a>:</h4>
<p>!Send is surely a hazard to turn into and from a Send type</p>



<a name="204166839"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204166839" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204166839">(Jul 17 2020 at 03:12)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> , the question is whether we can guarantee - either using the existing rules, or by making slight modifications to the rules - that <code>!Send</code> types will never be turned into <code>Send</code> types (and the same for <code>Sync</code>) without making explicit reference to <code>Send</code>/<code>Sync</code>.</p>



<a name="204166843"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204166843" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204166843">(Jul 17 2020 at 03:13)</a>:</h4>
<p>The hypothesis is that the way that the transmutation traits treat <code>UnsafeCell</code> may give us this for free.</p>



<a name="204166925"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204166925" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204166925">(Jul 17 2020 at 03:16)</a>:</h4>
<p>unlikely, you can be !Send without an UnsafeCell</p>



<a name="204173602"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204173602" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204173602">(Jul 17 2020 at 06:09)</a>:</h4>
<p>Yeah, that's what we figured, so the question is then whether there's a <em>small</em> modification we could make to make it sound. We'll see <span aria-label="slight smile" class="emoji emoji-1f642" role="img" title="slight smile">:slight_smile:</span></p>



<a name="204175128"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204175128" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204175128">(Jul 17 2020 at 06:46)</a>:</h4>
<p>My gut tells me that, overall, anything <code>!Send</code> is sufficiently "weird" that you probably just can't be blindly safe transmuting it. Even if the data validity is there, the fact that the thing cares about what thread it's in, for any reason, means that something is up.</p>



<a name="204179524"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204179524" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> rylev <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204179524">(Jul 17 2020 at 07:54)</a>:</h4>
<p>If a type makes use of non-local state (e.g., global state, thread local state) for soundness and/or correctness, we probably can't allow transmuting to that type. I have a feeling this goes beyond Send/Sync and is relevant to any arbitrary type.</p>



<a name="204199828"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204199828" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204199828">(Jul 17 2020 at 12:30)</a>:</h4>
<p>Yeah, <span class="user-mention" data-user-id="224872">@Ryan Levick</span> but that's where the field visibility requirement comes in.</p>



<a name="204199894"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204199894" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> rylev <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204199894">(Jul 17 2020 at 12:31)</a>:</h4>
<p><span class="user-mention" data-user-id="219211">@Jack Wrenn</span> ah yes. If all fields are pub you can trivially initialize the value so nothing can be hidden... Got ya</p>



<a name="204246343"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204246343" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204246343">(Jul 17 2020 at 19:07)</a>:</h4>
<p>Some considerations for framing this discussion:</p>
<p>Some constraints apply to bytes, others apply to variants, and others apply to entire types. E.g.:</p>
<ul>
<li>Stability is a property of types. A type has either the stability declaration traits, or it hasn't.</li>
<li>Constructibility is a property of variants. If a variant's fields are all marked <code>pub</code>, that variant can be freely constructed.</li>
<li>Validity is a property of sequences of bytes.</li>
</ul>
<p>Some constraints only apply behind references; E.g.:</p>
<ul>
<li><code>bool ⇒ u8</code></li>
<li><code>&amp;mut bool ↛ &amp;mut u8</code> (rejected because writes to the <code>&amp;mut u8</code> could invalidate the underlying bool)</li>
</ul>



<a name="204246689"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204246689" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204246689">(Jul 17 2020 at 19:10)</a>:</h4>
<p>I think <code>UnsafeCell</code> is probably a property affecting bytes. Given:</p>
<div class="codehilite"><pre><span></span><code><span class="cp">#[repr(C)]</span><span class="w"> </span><span class="k">struct</span> <span class="nc">Pair</span><span class="p">(</span><span class="kt">u8</span><span class="p">,</span><span class="w"> </span><span class="n">UnsafeCell</span><span class="o">&lt;</span><span class="kt">u8</span><span class="o">&gt;</span><span class="p">);</span><span class="w"></span>
</code></pre></div>


<p>Consider:</p>
<ul>
<li><code>Pair ⇒ [u8; 2]</code></li>
<li><code>&amp;Pair ↛  &amp;[u8; 2]</code>, second byte isn't actually immutable!</li>
<li><code>&amp;Pair ⇒  &amp;[u8; 1]</code></li>
</ul>



<a name="204248952"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204248952" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204248952">(Jul 17 2020 at 19:33)</a>:</h4>
<p>Another set of examples:</p>
<ul>
<li><code>&amp;u8 ⇒ &amp;UnsafeCell&lt;u8&gt;</code> fine, since subsequent operations on <code>UnsafeCell</code> are <code>unsafe</code></li>
<li><code>&amp;u8 ↛ &amp;AtomicU8</code> not fine, since there might be other <code>&amp;u8</code> kicking around doing unsynchronized loads</li>
</ul>
<p>In these examples, the big difference is that <code>UnsafeCell</code> is <code>!Send</code>, but <code>AtomicU8</code> (which contains an <code>UnsafeCell</code>) is <code>Send</code>.</p>



<a name="204786729"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204786729" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> rylev <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204786729">(Jul 23 2020 at 11:56)</a>:</h4>
<p><span class="user-mention" data-user-id="219211">@Jack Wrenn</span> what speaks against putting the RFC draft into the safe-transmute working group repo so that it's a tiny bit more visibile? We don't have to advertise its existence, but it's in a complete enough form that I think encouraging some feedback and using GitHub's commenting features would be useful.</p>



<a name="204811558"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204811558" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204811558">(Jul 23 2020 at 15:19)</a>:</h4>
<p><span class="user-mention" data-user-id="224872">@Ryan Levick</span> I'm using HackMD's <code>:::danger</code> and <code>:::warning</code> blocks to highlight TODOs. Github Markdown doesn't support these, so I'd like to at least resolve the last few urgent todos (<code>:::danger</code>) before moving to Github.</p>



<a name="204815074"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/204815074" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#204815074">(Jul 23 2020 at 15:48)</a>:</h4>
<p>Nailing down the rules around aliasing/send/sync are the last major TODO.</p>



<a name="205611398"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/205611398" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#205611398">(Jul 31 2020 at 16:27)</a>:</h4>
<p>Resolution: <span class="user-mention" data-user-id="132362">@Joshua Liebow-Feeser</span>  and I think we can punt on figuring out Send/Sync/UnsafeCell stuff merely by forcing the requirement of field visibility. Accordingly, I've removed the recommendation for a <code>NeglectVisibility</code> option, and will add some text about why permitting visibility to be neglected has unexpected consequences beyond library-imposed validity invariants.</p>



<a name="210725684"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Send/Sync/UnsafeCell/Uniqueness/near/210725684" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness.html#210725684">(Sep 21 2020 at 10:50)</a>:</h4>
<p><span class="user-mention silent" data-user-id="219211">Jack Wrenn</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/RFC.3A.20Send.2FSync.2FUnsafeCell.2FUniqueness/near/204248952">said</a>:</p>
<blockquote>
<p>Another set of examples:</p>
<ul>
<li><code>&amp;u8 ⇒ &amp;UnsafeCell&lt;u8&gt;</code> fine, since subsequent operations on <code>UnsafeCell</code> are <code>unsafe</code></li>
<li><code>&amp;u8 ↛ &amp;AtomicU8</code> not fine, since there might be other <code>&amp;u8</code> kicking around doing unsynchronized loads</li>
</ul>
<p>In these examples, the big difference is that <code>UnsafeCell</code> is <code>!Send</code>, but <code>AtomicU8</code> (which contains an <code>UnsafeCell</code>) is <code>Send</code>.</p>
</blockquote>
<p>Nit: <a href="https://doc.rust-lang.org/std/cell/struct.UnsafeCell.html#impl-Send"><code>UnsafeCell</code> is <code>Send</code></a> (which is normal, since <code>UnsafeCell</code> does not do anything with exclusive access), it's actually <code>!Sync</code></p>
<p>An interesting op , too, is that <code>&amp;mut u8 ⇒ &amp;UnsafeCell&lt;u8&gt;</code> is fine too</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>